Asus ASUSWRT 3.0.0.4.384.20308

CPE Details

Asus ASUSWRT 3.0.0.4.384.20308
asus
asuswrt
3.0.0.4.384.20308
2020-03-31
13h20 +00:00
2020-03-31
13h20 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:o:asus:asuswrt:3.0.0.4.384.20308:*:*:*:*:*:*:*

Informations

Vendor

asus

Product

asuswrt

Version

3.0.0.4.384.20308

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2022-26376 2022-08-05 21h18 +00:00 A memory corruption vulnerability exists in the httpd unescape functionality of Asuswrt prior to 3.0.0.4.386_48706 and Asuswrt-Merlin New Gen prior to 386.7.. A specially-crafted HTTP request can lead to memory corruption. An attacker can send a network request to trigger this vulnerability.
9.8
Critique
CVE-2018-20333 2020-03-19 23h11 +00:00 An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router and if there are apps installed on the router.
7.5
Haute
CVE-2018-20335 2020-03-19 23h11 +00:00 An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI.
7.5
Haute
CVE-2018-20334 2020-03-19 23h11 +00:00 An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.
9.8
Critique
CVE-2018-5999 2018-01-22 19h00 +00:00 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
9.8
Critique
CVE-2018-6000 2018-01-22 19h00 +00:00 An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999.
9.8
Critique